Himmelblau EUVD-2026-32633

Exploitation requires the attacker to already hold valid credentials for an account in the same Entra ID domain (or an accepted alias domain) as the target user, and to be able to initiate Himmelblau's Device Authorization Grant authentication flow against the host while specifying a different target username - the token's domain must match an accepted domain but the username mismatch is what is no longer caught (pre-3.1.5 / pre-2.3.11). Limiting factors: this is authenticated (PR:L) - anonymous attackers cannot exploit it; the attacker and victim must reside in the same or aliased domain; the high attack complexity (AC:H) reflects that a valid same-domain identity and the ability to manipulate the DAG account request are prerequisites; and multi-domain/alias deployments broaden the set of impersonatable accounts while single-tenant setups still permit cross-user impersonation within that domain.

The CVSS 3.1 base score is 8.4 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L), reflecting high confidentiality and integrity impact with a changed scope because a low-privileged user crosses an authorization boundary to act as another (potentially privileged) user. Two signals temper the raw score: AC:H indicates the attacker needs conditions beyond their control (a valid same-domain account and the ability to drive the DAG flow against a target username), and PR:L confirms authentication is required, so this is an insider/lateral-movement risk rather than anonymous internet exposure. No EPSS score, KEV entry, or public proof-of-concept was provided, so there is no evidence of active or automated exploitation; this looks like a targeted privilege-escalation/impersonation issue exploitable by existing domain users rather than a mass-scannable bug. Note the AV:N vector combined with the description's 'same Entra ID domain' framing means the network attack surface is the DAG/token exchange - verify against the deployment, as the practical exploitation point is a logged-in domain member targeting a shared host.

An employee with a valid but low-privileged Entra ID account that shares a domain with an administrator drives Himmelblau's Device Authorization Grant login against a shared Linux server, requesting a session for the administrator's username while authenticating with their own credentials. Because token_validate only checks the domain and not the username, Himmelblau grants the attacker a local Unix session as the administrator, yielding that user's data and privileges. No public proof-of-concept is identified, and the high attack complexity (AC:H) reflects the need for a valid same-domain account and control of the DAG request.